OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "extensions/common/csp_validator.h" | 5 #include "extensions/common/csp_validator.h" |
6 | 6 |
7 #include <vector> | 7 #include <vector> |
8 | 8 |
9 #include "base/strings/string_split.h" | 9 #include "base/strings/string_split.h" |
10 #include "base/strings/string_tokenizer.h" | 10 #include "base/strings/string_tokenizer.h" |
(...skipping 110 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
121 int options, | 121 int options, |
122 std::vector<std::string>* sane_csp_parts, | 122 std::vector<std::string>* sane_csp_parts, |
123 std::vector<InstallWarning>* warnings) { | 123 std::vector<InstallWarning>* warnings) { |
124 sane_csp_parts->push_back(directive_name); | 124 sane_csp_parts->push_back(directive_name); |
125 while (tokenizer->GetNext()) { | 125 while (tokenizer->GetNext()) { |
126 std::string source = tokenizer->token(); | 126 std::string source = tokenizer->token(); |
127 base::StringToLowerASCII(&source); | 127 base::StringToLowerASCII(&source); |
128 bool is_secure_csp_token = false; | 128 bool is_secure_csp_token = false; |
129 | 129 |
130 // We might need to relax this whitelist over time. | 130 // We might need to relax this whitelist over time. |
131 if (source == "'self'" || | 131 if (source == "'self'" || source == "'none'" || |
132 source == "'none'" || | |
133 source == "http://127.0.0.1" || | 132 source == "http://127.0.0.1" || |
134 LowerCaseEqualsASCII(source, "blob:") || | 133 base::LowerCaseEqualsASCII(source, "blob:") || |
135 LowerCaseEqualsASCII(source, "filesystem:") || | 134 base::LowerCaseEqualsASCII(source, "filesystem:") || |
136 LowerCaseEqualsASCII(source, "http://localhost") || | 135 base::LowerCaseEqualsASCII(source, "http://localhost") || |
137 StartsWithASCII(source, "http://127.0.0.1:", true) || | 136 StartsWithASCII(source, "http://127.0.0.1:", true) || |
138 StartsWithASCII(source, "http://localhost:", true) || | 137 StartsWithASCII(source, "http://localhost:", true) || |
139 isNonWildcardTLD(source, "https://", true) || | 138 isNonWildcardTLD(source, "https://", true) || |
140 isNonWildcardTLD(source, "chrome://", false) || | 139 isNonWildcardTLD(source, "chrome://", false) || |
141 isNonWildcardTLD(source, | 140 isNonWildcardTLD(source, std::string(extensions::kExtensionScheme) + |
142 std::string(extensions::kExtensionScheme) + | 141 url::kStandardSchemeSeparator, |
143 url::kStandardSchemeSeparator, | |
144 false) || | 142 false) || |
145 StartsWithASCII(source, "chrome-extension-resource:", true)) { | 143 StartsWithASCII(source, "chrome-extension-resource:", true)) { |
146 is_secure_csp_token = true; | 144 is_secure_csp_token = true; |
147 } else if ((options & OPTIONS_ALLOW_UNSAFE_EVAL) && | 145 } else if ((options & OPTIONS_ALLOW_UNSAFE_EVAL) && |
148 source == "'unsafe-eval'") { | 146 source == "'unsafe-eval'") { |
149 is_secure_csp_token = true; | 147 is_secure_csp_token = true; |
150 } | 148 } |
151 | 149 |
152 if (is_secure_csp_token) { | 150 if (is_secure_csp_token) { |
153 sane_csp_parts->push_back(source); | 151 sane_csp_parts->push_back(source); |
(...skipping 48 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
202 int options, | 200 int options, |
203 const std::vector<std::string>& directives) { | 201 const std::vector<std::string>& directives) { |
204 if (!(options & OPTIONS_ALLOW_INSECURE_OBJECT_SRC)) | 202 if (!(options & OPTIONS_ALLOW_INSECURE_OBJECT_SRC)) |
205 return false; | 203 return false; |
206 | 204 |
207 for (size_t i = 0; i < directives.size(); ++i) { | 205 for (size_t i = 0; i < directives.size(); ++i) { |
208 const std::string& input = directives[i]; | 206 const std::string& input = directives[i]; |
209 base::StringTokenizer tokenizer(input, " \t\r\n"); | 207 base::StringTokenizer tokenizer(input, " \t\r\n"); |
210 if (!tokenizer.GetNext()) | 208 if (!tokenizer.GetNext()) |
211 continue; | 209 continue; |
212 if (!LowerCaseEqualsASCII(tokenizer.token(), kPluginTypes)) | 210 if (!base::LowerCaseEqualsASCII(tokenizer.token(), kPluginTypes)) |
213 continue; | 211 continue; |
214 while (tokenizer.GetNext()) { | 212 while (tokenizer.GetNext()) { |
215 if (!PluginTypeAllowed(tokenizer.token())) | 213 if (!PluginTypeAllowed(tokenizer.token())) |
216 return false; | 214 return false; |
217 } | 215 } |
218 // All listed plugin types are whitelisted. | 216 // All listed plugin types are whitelisted. |
219 return true; | 217 return true; |
220 } | 218 } |
221 // plugin-types not specified. | 219 // plugin-types not specified. |
222 return false; | 220 return false; |
(...skipping 116 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
339 } | 337 } |
340 } | 338 } |
341 } | 339 } |
342 | 340 |
343 return seen_sandbox; | 341 return seen_sandbox; |
344 } | 342 } |
345 | 343 |
346 } // namespace csp_validator | 344 } // namespace csp_validator |
347 | 345 |
348 } // namespace extensions | 346 } // namespace extensions |
OLD | NEW |